{
    "type": "bundle",
    "id": "bundle--c06ab387-5835-4521-924a-3ac4fc9a8c98",
    "objects": [
        {
            "type": "attack-pattern",
            "spec_version": "2.1",
            "id": "attack-pattern--4dd718fa-805c-44c9-a65b-25ac3414d433",
            "created_by_ref": "identity--a1f731ef-8d5b-4cf7-b7ae-f7e728aa69d6",
            "created": "2022-07-02T19:59:12.671079Z",
            "modified": "2022-07-02T19:59:12.671079Z",
            "name": "Exploit Data Voids",
            "description": "A data void refers to a word or phrase that results in little, manipulative, or low-quality search  engine data. Data voids are hard to detect and relatively harmless until exploited by an entity  aiming to quickly proliferate false or misleading information during a phenomenon that causes a  high number of individuals to query the term or phrase. In the Plan phase, an influence operation  may identify data voids for later exploitation in the operation.  \nA 2019 report by Michael Golebiewski identifies five types of data voids. (1) \u201cBreaking news\u201d  data voids occur when a keyword gains popularity during a short period of time, allowing an  influence operation to publish false content before legitimate news outlets have an opportunity to  publish relevant information. (2) An influence operation may create a \u201cstrategic new terms\u201d data  void by creating their own terms and publishing information online before promoting their  keyword to the target audience. (3) An influence operation may publish content on \u201coutdated  terms\u201d that have decreased in popularity, capitalizing on most search engines\u2019 preferences for  recency. (4) \u201cFragmented concepts\u201d data voids separate connections between similar ideas,  isolating segment queries to distinct search engine results. (5) An influence operation may use  \u201cproblematic queries\u201d that previously resulted in disturbing or inappropriate content to promote  messaging until mainstream media recontextualizes the term.  ",
            "kill_chain_phases": [
                {
                    "kill_chain_name": "mitre-attack",
                    "phase_name": "microtarget"
                }
            ],
            "external_references": [
                {
                    "source_name": "DISARM",
                    "url": "https://github.com/DISARMFoundation/DISARM_framework/blob/master/techniques/T0102.003.md",
                    "external_id": "T0102.003"
                }
            ],
            "object_marking_refs": [
                "marking-definition--fcc474e3-5ec1-45a3-a4c4-e25e7fcdc639"
            ],
            "x_mitre_is_subtechnique": true,
            "x_mitre_platforms": [
                "Windows",
                "Linux",
                "Mac"
            ],
            "x_mitre_version": "1.0"
        }
    ]
}
